The Fetch standard states the following

Credentials are HTTP cookies, TLS client certificates, and authentication entries (for HTTP authentication).

and it also defines authentication entries as follows:

An authentication entry and a proxy-authentication entry are tuples of username, password, and realm, used for HTTP authentication and HTTP proxy authentication, and associated with one or more requests.

However, unless I'm missing something, not all authentication entries count as credentials in the sense used by CORS. For instance, Basic Zm9vOmJhcgo= does count as credential and, if present, will be automatically attached by the browser to credentialed requests issued by the client; but Bearer whatever doesn't count as credential in that sense.

Is the Fetch standard accurate in that respect? What am I missing? And if only some authentication entries count as credentials, is there some authoritative list of them?